Age Verification Is Sweeping Gaming. Is It Ready for the Age of AI Fakes?

In July, Siyan, a UK-based Discord user, logged on one morning and found himself unable to access some of his text chats marked NSFW. The channel, a popup informed him, was now age-restricted. The United Kingdom had enacted its far reaching child safety laws, which includes an age requirement system to verify users are over 18. Discord’s updates required users to verify their age, either by government ID or a face scan.

Siyan (who requested to only be referred to by his screen name for privacy reasons) describes himself as “painfully over the age of needing to fake an ID.” He didn’t want to take a photo of his ID. The face scan feature wasn’t yet available on mobile, he says, and he didn’t own a webcam, so he decided to give the platform someone else’s face. First, he tried using an emoji of “an old dude” he often uses on Discord. (“It speaks to me.”) Face scans, however, often require users to submit multiple shots that include them looking a specific way, or specific poses. Siyan needed a passable image of a man with an open mouth.

Two games in his library, Stellar Blade and Death Stranding, include a photo mode that allows players to pose a character and set their expressions; Siyan opted for Death Stranding’s Sam, modeled after 56-year-old actor Norman Reedus.

He dropped screenshots of his success into a discord, after which a friend posted them to X. Siyan’s gambit quickly went viral, inspiring others to try with games like Death Stranding, God of War, and more.

Age verification is now the norm in the UK, though similar laws worldwide are expected to have a profound impact on how we access the web. Companies like Google are rolling out AI-driven age estimation systems for Search and YouTube. On gaming platforms like Roblox, age checks are becoming a key element of safety measures. But whether by using IDs or face scanning, it’s an imperfect system. Several Discord users tell WIRED they’ve already managed to get around face scans using video game characters. Generative AI could make this problem even more difficult to control as the tech grows more sophisticated; just last month, WIRED wrote about a startup working on AI that can create video in real-time. Users are also worried about giving companies their personal information in case of security breaches.

In theory, age verification serves to keep kids safer. On platforms like Roblox, where failed moderation has allowed predators to groom or even assault some children, confirming that someone is a minor—or over the age of 18—is one way to determine what features they can use. For adult content sites like Pornhub, age verification aims to make sure children cannot access pornography. Critics, however, say the systems being put into place are flawed ones, both from a privacy and protection standpoint.

David Maimon, the head of fraud insights for SentiLink and a criminology professor at Georgia State University, says that the current methods of verification can still be fooled. People use many different methods to bypass “liveness checks”—security measures used to verify the user is a real person—whether that’s using AI, video games, or videos of other, real people. IDs can be faked, or bought. “The process of age verification is complicated,” he says, and people in charge of these systems need to give them more thought.

Ash, a UK-based 20-year-old who requested his last name not be used, tells WIRED he was able to pass verification using God of War’s photo mode with main character Kratos. “I didn't expect [verification] to work because of Kratos' white skin and beard, but it worked first try,” he says. Another Discord user in the UK, who goes by Antsy online, says he achieved the same results with Arma 3 and a mod that allows you to pose characters. “I figured out I could simply by trying, as all people should,” he tells WIRED. “Arma 3 characters look very poor, nowhere near realistic, so I thought it would be a solid experiment to solidify or challenge my views on this technology.” Antsy says he and his friends consider this kind of tech “a challenge” they try to bypass. “I am very pro internet safety,” he says. “I believe, though, that it should not be the internet’s job to parent and protect its younger users."

Video game characters from several games worked. In a video from YouTuber beebreadtech, he’s able to swiftly get an adult-age rating repeating Siyan’s steps with Death Stranding. Other Discord users WIRED talked to say they were able to do so with games like Days Gone, Baldur’s Gate 3, Cyberpunk 2077, The Sims 4, Cyberpunk 2077, Days Gone, Warhammer 40,000: Space Marine 2, Star Wars: Knights of the Old Republic, and Gray Zone Warfare. Some say they even successfully used Garry’s Mod, a game with slapstick physics and character models resembling something from a fever dream.

Discord has not yet responded to WIRED’s request for comment.

Maimon says there are too many possible loopholes with age verification that people can slip through. “The industry is trying to find solutions to the issue of AI deepfakes and and and live AIs,” he says. That may mean relying on a combination of factors that look at a person’s associated information like telephone numbers, addresses and more. “You need to rely more heavily on historical evidence for the existence of the individual,” Maimon says, “and put less of an emphasis on checkpoints like driver licenses, photos, livenessness tests, and so on.”

Maimon says that bad actors are adept at bypassing these kinds of technologies. “Criminals are always like 7 to 12 months ahead of us in terms of their ability to find vulnerabilities and bypass some of the technologies out there,” he says. Even without generative AI, people can still sell videos of their faces to pass age verification.

Even photo IDs aren’t bulletproof. “The quality of a [fake] driver license—it's just impeccable,” Maimon says. All the watermarks, the UV lights, all the security, even the right plastic material on which the driver license is being printed on—even that criminals now have access to.”

For legitimate IDs, there’s an issue with minors and who owns one. WIRED previously asked Roblox chief safety officer Matt Kaufman about 13-year-olds—the minimum age for Roblox to unlock some of its features—that might not have government-issued IDs. “That is a problem,” Kaufman told WIRED at the time, adding that in North America and the United States, it’s uncommon for people so young to have them.

“I’m hesitant to say that [photo ID] is a useful way to verify folks' age,” Maimon says, “simply because we have so much evidence suggesting that it doesn't work.”

There’s also hesitance on behalf of users to hand over their IDs. “I don't trust the third party services that are being used with my data, especially with how damaging data leaks can be,” Ash says. “Most of the verification apps say that they don't hold your data for more than seven days and while that might be true there's no way for me to know for sure that they are telling the truth.”

There’s a risk in handing over sensitive information to companies that request photo or ID verification. In July, Tea—an app where women can share their negative experiences with men—suffered a massive data breach that exposed thousands of women’s photos used for verification; a second security issue, according to 404 Media, allowed hackers to access sensitive information like phone numbers, social media handles, and real names through user messages, which has been spread throughout forums like 4chan to dox and harass women.

People WIRED spoke to who have used video games to trick verification are against age verification. “Requiring people to give up facial information to access all the features of websites and apps like Discord and Bluesky is a massive overreach of what governments should be allowed to ask for digitally,” Ash says.

Furthermore, he’s doubtful that such systems won’t be exploited, whether it’s by using video games or some other method. “I don't think that face scans are a useful way to verify age since people can easily look under their age and be incorrectly flagged as being under 18,” he says.

Antsy, the Discord user who passed verification with Arma 3, isn’t convinced websites or platforms should be in charge of verifying ages. “All you are doing by putting these laws into place is pushing young people towards corners of the internet the government can't police,” he says. “If someone believes this is protecting children more than an active parent already would, I refuse to believe they are well versed in the corners of the internet outside of the Google home page or their child’s life.”